42Crunch Platform release, July 2, 2025

This 42Crunch API Security Platform release improves the handling of large scan reports on the platform UI and the editing of Scan v2 configurations.

New features

The following are the new features and improvements to the existing ones in this release.

Improvements to scan reports

If a scan report is larger than 20 MB, browsers may have problems displaying it. For such reports, 42Crunch Platform now lets you download the report for viewing locally:

The screenshot shows a Scan v2 report of 19.98 Mb that is too large to show inthe browser. There is a separate download button for the report at the bottom of the panel.

For Scan v1, you can also try loading a large report on the UI anyway. The larger the report, the more time the loading will take, and with very large reports, the browser may fail to load it. The look and feel of large reports is similar to normal reports, but there are less filters available. If exported as JSON, the full report is downloaded.

The screenshot shows a large Scan v1 report displayed on the platform UI.

Support for viewing large scan reports on the platform UI will be expanded to Scan v2 report in a future release.

For normal-sized Scan v2 reports, tests that were skipped during the scan are now listed on a dedicated tab on the scan report.

For Scan v1, Conformance Scan now also includes the header X-Scan-Transactionid in each request it sends, which allows creating rules, for example, for logging these requests in your other systems.

Improvements to editing scan configurations and scan rules

In addition, we have improved the user experience when editing Scan v2 configurations:

  • Freely move between different tabs on the UI that allow you to change the scan configuration, without having to save every time you change a tab.
  • Click just one save button to save all changes to the configuration at one go.
  • Your changes are tracked, so that if you change to another tab and come back, all values and other changes you made are still there.
  • No need to remember what it was that you changed:

If you go to General information or Web editor tabs of the scan configuration, or decide to navigate elsewhere in the platform, you are reminded of your unsaved changes and prompted to save them.

For more information what you can do with scan configurations, see Scan configuration details.

Previously, the method CONNECT was erroneously included in the list of methods to be skipped in scan rules. However, CONNECT is not supported in the OpenAPI Specification (OAS), and thus is now automatically skipped during the scan.

Other improvements

You can now include the setting overwrite_teams for specific API collections in the 42c-conf.yaml file of the CI/CD plugin REST API Static Security Testing.

  • Whenever the plugin runs, it compares the team sharing settings these API collections have in 42Crunch Platform with what has been defined in the configuration file.
  • If the teams that a collection has been shared with or the access levels the teams have to it do not match, for example, because someone changed them on the platform side, the plugin overrides the team sharing settings in the platform and replaces them with what you have defined in the 42c-conf.yaml file.

For more information, see the configuration examples in our Resources repository in GitHub.

As well as on the platform UI, large scan reports are also supported in our IDE extension OpenAPI (Swagger) Editor.

We have also fixed the following bugs:

  • Previously, the 42Crunch API Security Testing (AST) binary ignored the mandatory tags defined in the settings of OpenAPI (Swagger) Editor extension. Now AST correctly takes the tag from the extension settings into account when running an audit.
  • Previously, creating a scan configuration in your IDE failed without proper explanation if your API had structural or semantic issues. Now, if the configuration creation fails because of structural or semantic issues, you are given a clear error and recommended to run API Security Audit before trying again.
  • Previously, the number of issues in the audit report did not match in the JSON report and the exported CSV list of found issues, due to a difference how the best practices issues (warnings) were counted. This has now been aligned between the JSON report and the CSV so that the total number of found issues match.

Compatibility

This section lists the compatible Docker images for some of the components of 42Crunch API Security Platform, as well as other possible compatibility details.

API Firewall images

This release is compatible with the following API Firewall images:

  • NEW: 42crunch/apifirewall:v1.1.12
    • Fixed handling of schema validating errors
    • Upgrade to go-1.24.4 (CVE-2024-45338)
    • Upgrade to go-grpc 1.73.0

We highly recommend that you switch to the latest image version to take full advantage of the new features and security improvements. The following previous images remain compatible and can be used with this platform release:

  • 42crunch/apifirewall:v1.1.11
    • Fixed resource consumption on graceful restart
  •  42crunch/apifirewall:v1.1.9
    • Upgrade to expat 2.7.0-r0 (CVE-2024-8176)
    • Upgrade to golang.org/x/net 0.36.0 (CVE-2025-22870)
  • 42crunch/apifirewall:v1.1.8
    • Upgrade to openssl-3.3.3 (CVE-2024-12797, CVE-2024-13176)
  • 42crunch/apifirewall:v1.1.7
    • Fixed the failure in forwarding large request bodies
    • Upgrade to go-1.23.4 (CVE-2024-45338)
  • 42crunch/apifirewall:v1.1.6
    • Upgrade to openssl-3.3.2-r1 (CVE-2024-9143)
  • 42crunch/apifirewall:v1.1.5
    • Switch to the system certificate store to fix certificate authority renewal issue

All previous image versions have been deprecated and are no longer supported. We highly recommend that you switch to the latest image version to take the full advantage of the new features and security improvements.

When you switch the version of the API Firewall image, you must reconfigure any existing protection configurations so that they work with the new version. For more details, see Reconfigure API Protection.

Conformance Scan images

This release is compatible with the following Conformance Scan images for running it on-premises.

We have aligned the scan image version numbering with the version of the platform release, and from now on the minor version number will be the same as the platform release. The major release number will still indicate if the image is for Scan v1 or Scan v2.

Scan v2

  • NEW: 42crunch/scand-agent:v2.47.0
    • Ignore unsupported HTTP methods
    • X-Scan-Transactionid included in every request
    • Upgrade to chi v5.2.2 (CWE-601)

We highly recommend that you switch to the latest image version to take full advantage of the new features and security improvements. The following previous images remain compatible and can be used with this platform release:

  • 42crunch/scand-agent:v2.46.3
    • Upgrade to Golang 1.24.4 (CVE-2025-0913, CVE-2025-22874, CVE-2025-4673)
  • 42crunch/scand-agent:v2.46.1
    • Scan rules defined in the platform taken into account in scans
    • URL normalization
  • 42crunch/scand-agent:v2.45.0
    • Upgrade to Golang 1.24.2 (CVE-2025-22871)
    • Upgrade to golang.org/x/net v0.39.0 (CVE-2025-22872)
  • 42crunch/scand-agent:v2.0.21
    • Support for OWASP API Security Top 10 2023
    • Sub-schemas from anyOf constructions excluded from testing
    • Improved generation of Boolean values in tests
    • Upgrade to golang-jwt/jwt/v5 v5.2.2 (CVE-2025-30204)
    • Upgrade to go-redis/v9 v9.7.3 (CVE-2025-29923)
    • Upgrade to kin-openapi v0.131.0 (CVE-2025-30153)
  • 42crunch/scand-agent:v2.0.20
    • Fixed response validation on arrays
    • Upgrade to golang.org/x/net v0.37.0 (CVE-2025-22870)
  • 42crunch/scand-agent:v2.0.19
    • Initial support for the OAS v3.1 in Conformance Scan
    • Improved .p12 support
    • Upgrade to golang.org/x/oauth2 v0.25.0 (CVE-2025-22868)
    • Upgrade to golang.org/x/crypto v0.33.0 (CVE-2025-22869)
  • 42crunch/scand-agent:v2.0.18
    • Fixed handling of empty scenario list in the lax scanning mode
    • Increased maximum number of items in generated arrays
  • 42crunch/scand-agent:v2.0.17
    • Upgrade to go-git v5.13.1 (CVE-2025-21613, CVE-2025-21614)
    • Upgrade to nanoid v3.3.8 (CVE-2024-55565)
    • Upgrade to golang.org/x/net v0.33.0 (CVE-2024-45338)
    • Upgrade to golang.org/x/crypto v0.31.0 (CVE-2024-45337)
  •  42crunch/scand-agent:v2.0.15
    • Fixed replacement of placeholder texts in variables when generating test requests
    • Fixed generation of properties in test requests
    • Fixed regression on null enums
  • 42crunch/scand-agent:v2.0.13
    • A new property in the scan report to indicate if running a scan test succeeded or not
  • 42crunch/scand-agent:v2.0.12
    • Fixed scan report timestamp
  • 42crunch/scand-agent:v2.0.11
    • Upgrade to Golang v1.23.1 (CVE-2022-30635, CVE-2024-34155, CVE-2024-34156, CVE-2024-34158)
  • 42crunch/scand-agent:v2.0.10
    • New test response-body-badformat-scan
    • Fixed scan configuration creation when items is null
    • Fixed excessive data exposure reporting
  • 42crunch/scand-agent:v2.0.9
    • Scan v2 in v1-compatible mode
    • Support for Accept headers
    • Upgrade to Golang 1.22.5 (CVE-2024-24789, CVE-2024-24790, CVE-2024-24791)
  • 42crunch/scand-agent:v2.0.8
    • New test path-item-method-not-allowed-no-authn-scan
    • Support for apiConnectivityCheck, maxTimeoutRetryAttempts, and requestHeaderNameRequestType
    • Fixed implementation of reportIncludeRequestBody and reportIncludeResponseBody
    • Fixed handling of lookahead and lookbehind assertion references in regular expressions
  • 42crunch/scand-agent:v2.0.7
    • Upgrade to Golang 1.22.3 (CVE-2020-8559, CVE-2024-24788)
  • 42crunch/scand-agent:v2.0.6
    • Lax testing mode
    • Fixed generating conformance test requests when multiple required properties are defined
  • 42crunch/scand-agent:v2.0.4
    • Numeric values exceeding the limits of float64 presented as strings
  • 42crunch/scand-agent:v2.0.3
    • Upgrade to Golang 1.21.5 (CVE-2023-45284, CVE-2023-45283, CVE-2023-39326, CVE-2023-45283)
    • New scan report
    • Tests parameter-header-contenttype-wrong-scan and partial-security-accepted
    • Support for reportIncludeRequestBody, reportIncludeResponseBody, reportMaxRequestSizeHappyPath, reportMaxRequestSizeTest
    • Improved logging for runtime limit
    • Heartbeat check

All previous image versions have been deprecated and are no longer supported.

Scan v1

  • NEW: 42crunch/scand-agent:v1.47.0
    • Ignore unsupported HTTP methods
    • X-Scan-Transactionid included in every request
    • Upgrade to chi v5.2.2 (CWE-601)

We highly recommend that you switch to the latest image version to take full advantage of the new features and security improvements. The following previous images remain compatible and can be used with this platform release:

  • 42crunch/scand-agent:v1.46.3
    • Upgrade to Golang 1.24.4 (CVE-2025-0913, CVE-2025-22874, CVE-2025-4673)
  • 42crunch/scand-agent:v1.46.0
    • Internal cleanup and refactoring
  • 42crunch/scand-agent:v1.45.0
    • Upgrade to Golang 1.24.2 (CVE-2025-22871)
    • Upgrade to golang.org/x/net v0.39.0 (CVE-2025-22872)
  • 42crunch/scand-agent:v1.22.27
    • Support for OWASP API Security Top 10 2023
    • Sub-schemas from anyOf constructions excluded from testing
    • Improved generation of Boolean values in tests
    • Upgrade to golang-jwt/jwt/v5 v5.2.2 (CVE-2025-30204)
    • Upgrade to go-redis/v9 v9.7.3 (CVE-2025-29923)
    • Upgrade to kin-openapi v0.131.0 (CVE-2025-30153)
  • 42crunch/scand-agent:v1.22.25
    • Initial support for the OAS v3.1 in Conformance Scan
    • Improved .p12 support
    • Upgrade to golang.org/x/oauth2 v0.25.0 (CVE-2025-22868)
    • Upgrade to golang.org/x/crypto v0.33.0 (CVE-2025-22869)
  • 42crunch/scand-agent:v1.22.24
    • Fixed handling of nullable enums and empty strings
    • Increased maximum number of items in generated arrays
  • 42crunch/scand-agent:v1.22.23
    • Upgrade to go-git v5.13.1 (CVE-2025-21613, CVE-2025-21614)
    • Upgrade to nanoid v3.3.8 (CVE-2024-55565)
    • Upgrade to golang.org/x/net v0.33.0 (CVE-2024-45338)
    • Upgrade to golang.org/x/crypto v0.31.0 (CVE-2024-45337)
  • 42crunch/scand-agent:v1.22.21
    • Default value maximum scan report size 20 MB to align with Scan v2
  • 42crunch/scand-agent:v1.22.20
    • Fixed excessive data exposure reporting
  • 42crunch/scand-agent:v1.22.19
    • Upgrade to Golang v1.23.1 (CVE-2022-30635, CVE-2024-34155, CVE-2024-34156, CVE-2024-34158)
    • Happy path tests included in the number of tests
  • 42crunch/scand-agent:v1.22.18
    • Fixed scan configuration creation when items is null
  • 42crunch/scand-agent:v1.22.17
    • Upgrade to Golang 1.22.5 (CVE-2024-24789, CVE-2024-24790, CVE-2024-24791)
  • 42crunch/scand-agent:v1.22.16
    • Upgrade to Golang 1.22.3 (CVE-2020-8559, CVE-2024-24788)
  • 42crunch/scand-agent:v1.22.15
    • Fixed handling of query parameters in request generation
    • Fixed generating conformance test requests when multiple required properties are defined
  • 42crunch/scand-agent:v1.22.14
    • Upgrade to Golang 1.21.5 (CVE-2023-39326, CVE-2023-45283)
  • 42crunch/scand-agent:v1.22.13
    • Upgrade to Golang 1.21.3 (CVE-2023-45284, CVE-2023-45283)
    • Heartbeat check to keep the connection to 42Crunch Platform active in case of extremely long scans
    • Fixed handling of example and x-42c-sample
  • 42crunch/scand-agent:v1.22.12
    • Support for text/plain as content type
    • Support for read-only properties
  • 42crunch/scand-agent:v1.22.11
    • Upgrade to Golang 1.20.7 (CVE-2023-39319, CVE-2023-39318, CVE-2023-3978, CVE-2023-29409)
    • Fixed handling of < and > characters in the request payload
    • Improved handling of content not supported by Conformance Scan
  • 42crunch/scand-agent:v1.22.9
    • Performance improvements to scan configuration generation
    • Better memory handling when generating array items of the type file for scan requests
    • Better handling of expired customization rules
    • Improved JSON schema validation for UTF-8 strings
  • 42crunch/scand-agent:v1.22.8
    • Upgrade to Golang 1.20.4 (CVE-2022-41716, CVE-2022-41717, CVE-2022-41720, CVE-2022-41722, CVE-2022-41723, CVE-2022-41724, CVE-2022-41725, CVE-2023-24532, CVE-2023-24534, CVE-2023-24536, CVE-2023-24537, CVE-2023-24538, CVE-2023-24539, CVE-2023-24540, CVE-2023-29400)
  • 42crunch/scand-agent:v1.22.7
    • Updates to regular expression library
  • 42crunch/scand-agent:v1.22.6
    • Fixed regular expressions handling

      In some rare cases, certain regular expression patterns could send the on-premises scan to an infinite loop, and the process would not finish. This image version fixes that, so if you are experiencing on-premises scan hanging, we recommend upgrading from the previous scan images to this one.

  • 42crunch/scand-agent:v1.22.4
    • Improved array iteration

All previous image versions have been deprecated and are no longer supported.

Changed behavior

To avoid unpredictable behavior, no directives from default customization rules are combined with directives from tag-based rules anymore. Now, the tag-based rules completely override the default rules, and default rules are only applied to APIs that have no other customization rules applied to them.

Known issues

This release has the following known issues.

Manage teams permission not shown on list of users

The permission to manage teams is not yet shown on the list of users in your organization, but you can view all permissions that a user has by clicking the permission column. This permission also does not yet have a shortcut that you could use when searching by permission.

These will be fixed in a future release.

Changing tagging on an API may trigger an unrelated error on the UI

Sometimes applying tags to or removing them from an API may trigger an unrelated error on failing to fetch the SQG approval report for the API. This happens if the API in question has been scanned on-premises and the scan has finished after you arrived on the API Summary page, because the UI cannot find the latest on-premises scan report and the associated approval report. Refreshing the page gets the latest reports and resolves the issue.

Tagging and untagging the API is not affected by this error: tags get correctly applied and removed in any case.

This will be fixed in a future release.

Data dictionary duplication

Duplicating a data dictionary does not yet duplicate the values in it.

This will be fixed in a future release.

Scan customization rules may lead to no response codes being accepted.

In some cases, scan rules can lead to HTTP status response codes in API responses that are normally expected (for example, HTTP 401 or HTTP 404) to be treated as unexpected. This in turn can lead to a false positive in the scan results.

By default, the expected HTTP status response codes that are defined in scan rules applied to the scanned API take preference over the response codes that Conformance Scan would otherwise expect. However, this can cause problems in scan process if your scan rule only skips header or response body analysis but does not define any expected response codes, either for happy path requests or for particular test IDs. This results in the scan rule to have null defined as the expected response code, and because the scan rule takes preference over the default scan behavior, no response codes except null are accepted. This in turn means that some tests are incorrectly flagged as returning unexpected response codes when they were in fact successful.

We are currently investigating the best way how to reconcile the designed behavior of Conformance Scan and scan rules in these cases, and this issue will be fixed in a future release.